https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T23:48:46.513769+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-332062 EUVD-2026-332062 2026-10-02T23:48:46.521816+00:00 EUVD-2026-332062 https://cve.radiocsirt.org/vuln/fkie_cve-2026-5142 fkie_cve-2026-5142 2026-10-02T23:48:46.521858+00:00

A flaw was found in foreman. Authenticated users with 'view_keypairs' permission can bypass taxonomy scoping, allowing them to download private SSH (Secure Shell) keys from other organizations by directly querying key pair IDs. This vulnerability leads to cross-tenant data exposure in multi-tenant deployments, potentially compromising sensitive information.

 https://cve.radiocsirt.org/vuln/ghsa-h2gj-g5gx-f7qq GHSA-h2gj-g5gx-f7qq 2026-10-02T23:48:46.521892+00:00

A flaw was found in foreman. Authenticated users with 'view_keypairs' permission can bypass taxonomy scoping, allowing them to download private SSH (Secure Shell) keys from other organizations by directly querying key pair IDs. This vulnerability leads to cross-tenant data exposure in multi-tenant deployments, potentially compromising sensitive information.

 https://cve.radiocsirt.org/vuln/rhsa-2026:34365 RHSA-2026:34365 — Red Hat Security Advisory: Satellite 6.19.2 Async Update 2026-10-02T23:48:46.521909+00:00

foreman: Foreman: Unauthorized modification of host configurations via broken access control foreman: Foreman: Privilege escalation to administrator-level access via usergroup role assignment manipulation foreman: Foreman: Information disclosure via improper validation of nested request parameters foreman: foreman: Cross-tenant private SSH key disclosure via taxonomy scoping bypass net/url: Incorrect parsing of IPv6 host literals in net/url com.mchange/mchange-commons-java: mchange-commons-java: Arbitrary code execution via JNDI dereferencing of crafted objects crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application Pillow: Pillow: Denial of Service via decompression bomb in FITS image processing python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2166 WID-SEC-W-2026-2166 — Red Hat Satellite (foreman, python-pillow, go): Mehrere Schwachstellen 2026-10-02T23:48:46.521945+00:00

Ein Angreifer kann mehrere Schwachstellen in Red Hat Satellite ausnutzen, um sich erweiterte Rechte, einschließlich Administratorrechte, zu verschaffen, die Authentifizierung zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand zu verursachen.